AppSecNews

DAST

Dynamic Application Security Testing

Probe a running application from the outside, the way an attacker would.

34 tools profiled

How it differs Tests the running application from the outside, with no access to source. SAST never runs the app; IAST instruments it from the inside.

License
Subcategory
Deployment
Languages
Integrations
Maturity
Signals
Clear

15 tools match

Active Self hosted Clear all

  • Acunetix

    Invicti Security

    DAST

    Commercial dynamic application security scanner that crawls web apps with a headless browser engine and confirms many injection findings by exploiting them.

    Commercial
    Established

  • AppCheck

    AppCheck

    DAST

    Commercial scanning platform that covers web applications, APIs and network infrastructure from a single console, backed by an in-house research team.

    Commercial
    Established

  • Arachni

    Arachni Project (Tasos Laskos)

    DAST

    Ruby based web application security scanner with an integrated browser environment, driven from the command line or a self hosted web interface.

    Open source
    Established

  • Bright Security

    Bright Security

    DAST

    Developer oriented dynamic scanner for web apps and APIs that validates each finding before reporting it, designed to run on every build.

    Freemium
    Growing

  • Burp Suite

    PortSwigger

    DAST

    Intercepting proxy and testing toolkit that puts a human in the request path, with an automated scanner and an extension ecosystem around it.

    Freemium
    Established Verified

  • Caido

    Caido Labs

    DAST

    Web security testing proxy built around a separate client and server, with a query language for filtering traffic and a plugin system for automation.

    Not recorded
    Growing

  • Fortify WebInspect

    OpenText

    DAST

    Long established enterprise dynamic scanner with deep scan configuration, macro based authentication and an optional runtime agent for deeper visibility.

    Commercial
    Established

  • GitLab DAST

    GitLab

    DAST

    Dynamic scanning built into GitLab pipelines, running a browser based analyzer against a deployed review environment and reporting into merge requests.

    Commercial
    Established

  • Acunetix

    Invicti Security

    Commercial dynamic application security scanner that crawls web apps with a headless browser engine and confirms many injection findings by exploiting them.

    Commercial Established
    DAST

  • AppCheck

    AppCheck

    Commercial scanning platform that covers web applications, APIs and network infrastructure from a single console, backed by an in-house research team.

    Commercial Established
    DAST

  • Arachni

    Arachni Project (Tasos Laskos)

    Ruby based web application security scanner with an integrated browser environment, driven from the command line or a self hosted web interface.

    Open source Established
    DAST

  • Bright Security

    Bright Security

    Developer oriented dynamic scanner for web apps and APIs that validates each finding before reporting it, designed to run on every build.

    Freemium Growing
    DAST

  • Burp Suite

    PortSwigger

    Intercepting proxy and testing toolkit that puts a human in the request path, with an automated scanner and an extension ecosystem around it.

    Freemium Established
    DAST

  • Caido

    Caido Labs

    Web security testing proxy built around a separate client and server, with a query language for filtering traffic and a plugin system for automation.

    Not recorded Growing
    DAST

  • Fortify WebInspect

    OpenText

    Long established enterprise dynamic scanner with deep scan configuration, macro based authentication and an optional runtime agent for deeper visibility.

    Commercial Established
    DAST

  • GitLab DAST

    GitLab

    Dynamic scanning built into GitLab pipelines, running a browser based analyzer against a deployed review environment and reporting into merge requests.

    Commercial Established
    DAST

  • HCL AppScan

    HCLSoftware

    DAST

    Long established enterprise application security suite whose dynamic scanner crawls and audits running applications with heavy scan configuration options.

    Commercial
    Established

  • Invicti

    Invicti Security

    DAST

    Enterprise dynamic scanner, formerly Netsparker, that confirms many injection findings by safely exploiting them before reporting.

    Commercial
    Established

  • Mayhem

    ForAllSecure

    DAST

    Autonomous fuzzing platform that combines coverage-guided mutation with symbolic execution to drive programs and APIs into crashing states.

    Commercial
    Growing

  • Qualys WAS

    Qualys

    DAST

    Web application scanning module of the Qualys platform, sharing its sensor network, asset model and reporting with infrastructure vulnerability management.

    Commercial
    Established

  • Rapid7 InsightAppSec

    Rapid7

    DAST

    Cloud-managed dynamic scanner that crawls and attacks web applications through distributed engines, with replayable proof steps for each finding.

    Commercial
    Established

  • Tenable Web App Scanning

    Tenable

    DAST

    Web application scanning module of the Tenable platform, using a browser-based crawler and sharing asset inventory and reporting with infrastructure scanning.

    Commercial
    Established

  • ZAP

    ZAP project, Software Security Project

    DAST

    Open source intercepting proxy and scanner that passively analyzes proxied traffic and actively attacks discovered endpoints, scriptable end to end.

    Open source
    Established Verified

  • HCL AppScan

    HCLSoftware

    Long established enterprise application security suite whose dynamic scanner crawls and audits running applications with heavy scan configuration options.

    Commercial Established
    DAST

  • Invicti

    Invicti Security

    Enterprise dynamic scanner, formerly Netsparker, that confirms many injection findings by safely exploiting them before reporting.

    Commercial Established
    DAST

  • Mayhem

    ForAllSecure

    Autonomous fuzzing platform that combines coverage-guided mutation with symbolic execution to drive programs and APIs into crashing states.

    Commercial Growing
    DAST

  • Qualys WAS

    Qualys

    Web application scanning module of the Qualys platform, sharing its sensor network, asset model and reporting with infrastructure vulnerability management.

    Commercial Established
    DAST

  • Rapid7 InsightAppSec

    Rapid7

    Cloud-managed dynamic scanner that crawls and attacks web applications through distributed engines, with replayable proof steps for each finding.

    Commercial Established
    DAST

  • Tenable Web App Scanning

    Tenable

    Web application scanning module of the Tenable platform, using a browser-based crawler and sharing asset inventory and reporting with infrastructure scanning.

    Commercial Established
    DAST

  • ZAP

    ZAP project, Software Security Project

    Open source intercepting proxy and scanner that passively analyzes proxied traffic and actively attacks discovered endpoints, scriptable end to end.

    Open source Established
    DAST
Tick up to 4 tools above.